Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:83649
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.192.48 as permitted sender)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
In-Reply-To: <CAGa2bXZiiT-6GLkx2d+EE1jp2BjXpEB3pgmKYLedFRgoyR=XUQ@mail.gmail.com>
References: <CAGa2bXa=LHMT+wdSM_xbHDo1901QDSFa-KotjQckNwVX9wUEUQ@mail.gmail.com>
 <CAGa2bXZ0VCC4ZN0=YU8ZE9LXm8m9j-RJnmYOhd5qrENoa1HimQ@mail.gmail.com>
 <CA+9eiLvV-wY-6BC5FHZM=uMAWm4Ny4Ej_m2F31o6DNGacpfJPQ@mail.gmail.com> <CAGa2bXZiiT-6GLkx2d+EE1jp2BjXpEB3pgmKYLedFRgoyR=XUQ@mail.gmail.com>
Date: Tue, 24 Feb 2015 19:39:42 +0900
Message-ID: <CAGa2bXbxO0dSs_v9avCeyB0WU8d4N1Bmuu07wZ500Wsami8rkQ@mail.gmail.com>
To: "internals@lists.php.net" <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=001a11432238520991050fd32556
Subject: Re: [RFC] Script only include/require
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

--001a11432238520991050fd32556
Content-Type: text/plain; charset=UTF-8

Hi all,

On Tue, Feb 24, 2015 at 7:20 PM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:

> On Tue, Feb 24, 2015 at 4:00 PM, Dmitry Stogov <dmitry@zend.com> wrote:
>
>> Use E_ERROR.
>>
>>
>>>
>>>
>>> https://github.com/php/php-src/pull/1111/files#diff-93ad74868f98ff7232ebea00007c8b7fR624
>>>
>>> Does engine exception catches error from zend_error_noreturn()?
>>>
>>
>> no. it'll be changed into zend_error().
>>
>
> Thank you for the comment.
>
> I'm not a security expert, but I think that adding check for script
>> extension won't add significant level of protection.
>>
>
> I agree. For developers who have more than average skills, this RFC
> would not be helpful. File inclusions by readfile()/etc are fatal as well
> also. Users must be careful anyway.
>
> My objective is to reduce risk of server takeover by script inclusions
> as low as other languages and being nice to new developers. I've audited
> number of web applications written by various languages, there aren't much
> difference in programmers' skills. My samples are too few and do not
> represent actual figures, but we'll have less vulnerable PHP apps by this.
> IMHO.
>

I would like to show one common example that is unique to PHP.

https://www.google.co.jp/search?q=Exif+Webshell+Backdoor

This RFC prevents this type of attack effectively. All users has to do is
"checking
file extension is image".

Regards,

--
Yasuo Ohgaki
yohgaki@ohgaki.net

--001a11432238520991050fd32556--